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Abstract 

With the projected higher demand for Network Systems Analysts and increasing computer 
crime, network security specialists are an organization's first line of defense. The principle 
function of this paper is to provide the evolution of Collegiate Cyber Defense Competitions 
(CCDC), event planning required, soliciting sponsors, recruiting personnel for the operations, 
red, white and blue teams. Information on one school's preparation will be provided with a 
review of what could have been improved to prepare their team for the competition. 

Keywords: cyber defense, student competitions, security education, intrusion detection, se¬ 
curity, network security 


1. INTRODUCTION 

The Bureau of Labor Statistics identified 
Network Systems and Data Communication 
Analysts as the fastest growing occupation 
with a percentage increase of 53.4% by 
2016. In 2006 there were 262,000 Network 
Systems and Data Communication Analysts 
positions nationally with a projected increase 
to 402,000 by 2016. The most significant 
source of postsecondary education or train¬ 
ing is a Bachelor's degree (Bureau of Labor 
Statistics, 2006). 


The Computer Crime and Security Survey 
indicated that the previous five years 
showed a decrease in cybercrime losses but 
this year respondents reported a significant 
increase. In addition, the number of re¬ 
ported intrusions was 29% (CSI Survey, 
2007). The Los Angeles County District At¬ 
torney, Steve Cooley, stated that "theft of 
proprietary information, personal identifiable 
information, and intellectual property is the 
fastest growing category of crime in the 
U.S." 
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With the projected higher demand of Net¬ 
work Systems Analysts and increasing com¬ 
puter crime, Network Analysts can become 
critical to an organization's security de¬ 
fenses. Network Analysts job duties include 
not only the selection, setup, and mainten¬ 
ance of networks, but also the monitoring of 
the network for unusual or suspicious activi¬ 
ty. Network Analysts are typically an organ¬ 
ization's first line of defense against intrud¬ 
ers. 

With the increasing demand for network pro¬ 
fessionals with a Bachelor's Degree coupled 
with increasing computer crime, universities 
are looking for ways to educate students in 
security issues. In the academic environ¬ 
ment, it can be difficult providing real-world 
experiences when dealing with issues like 
security over your computer resources. Uni¬ 
versities are concerned that students may 
use tactics demonstrated in class for their 
own personal gain that violates the law. 
High school students have broken into com¬ 
puter systems to change grades and AP test 
scores to improve their college admission 
acceptances (Top Tech News, 2008). 

One way that universities are training stu¬ 
dents to be the cyber defenders of tomorrow 
is through Collegiate Cyber Defense Compe¬ 
titions (CCDC). Competitions such as these 
teach students to be defenders, rather than 
attackers. Students must understand the 
security vulnerability, how it can be ex¬ 
ploited, and ways to minimize the risk to an 
organization. This paper provides a descrip¬ 
tion of CCDC, the university's participation in 
such a competition, and learning expe¬ 
riences. 

2. EARLY CYBER DEFENSE 
COMPETITIONS 

U. S. Service Academies for the Air Force, 
Army, Navy, Coast Guard, and Merchant Ma¬ 
rine began a competition to test the network 
defense skills of their students. Each team 
was responsible for setting up and maintain¬ 
ing a closed secured computer network. A 
group of National Security Agency (NSA) 
specialists graded each team on their ability 
to maintain their network services while de¬ 
tecting, analyzing, and responding to poten¬ 
tial intrusions. 

A trophy is awarded to the team determined 
to be most successful by the NSA. "The tro¬ 


phy is a tangible reward for the winning 
team, but ultimately, experience is the win 
for every student and NSA. At the end of 
the day, we've created a new crop of infor¬ 
mation assurance torchbearers who have an 
understanding of the strategic imperative of 
safeguarding the nation's security." (NSA 
Press Release, 2006) 

3. REGIONAL COLLEGIATE CYBER 
DEFENSE COMPETITIONS 

Seeing the success of the U.S. military acad¬ 
emy's competition in preparing students to 
be defenders, a group of government, aca¬ 
demics, students, and industry representa¬ 
tives decided to create uniform cyber de¬ 
fense exercises for post-secondary education 
in February of 2004. The group decided 
that a uniform structure would allow any 
university to hold a challenge regardless of 
size or resources available. The primary 
goal was to encourage more universities to 
offer students real-world experience in in¬ 
formation assurance. The first Collegiate 
Cyber Defense Competition (CCDC) was 
hosted by the Center for Infrastructure As¬ 
surance and Security at the University of 
Texas, San Antonio in April of 2005. (Na¬ 
tional Collegiate Cyber Defense Competition 
website) 

Teams 

The template that a regional competition 
follows includes three main teams named 
using patriotic colors of red, white, and blue. 
Student teams are assigned the color blue 
and are segregated from all other teams in 
their own classroom/lab. Each team is re¬ 
quired to have a faculty advisor from their 
school and a designated team captain. They 
are provided hardware and software to setup 
their network and secure it before the red 
team begins their exercises approximately 2 
hours later. Software installed on some 
servers may not be current and may have 
known security vulnerabilities that the blue 
team needs to evaluate and address. 

The red team consists of industry represent¬ 
atives that will attempt to infiltrate or dis¬ 
rupt each blue team's daily network opera¬ 
tions throughout the competition. The red 
team will use all their technical skills to 
compromise their network and disrupt busi¬ 
ness, in addition to, using social engineering 
to gain valuable information. The only at- 


© 2010 EDSIG 


http://isedj.org/8/14/ 


April 22, 2010 



ISEDJ 8 (14) 


Carlin, Manson, and Zhu 


5 


tack barred from the competition is a denial- 
of-service (DOS) attack as it was felt that 
blue teams may not react timely and result 
in all the blue teams' networks to lose ser¬ 
vice. 

The white team also consists of industry pro¬ 
fessionals responsible for monitoring the 
network, implementing scenario events, and 
refereeing. A White Team member will veri¬ 
fy service functionality prior to competition 
scoring commences. The scoring is based 
on keeping required services up, control¬ 
ling/preventing unauthorized access, and 
completing business tasks requested by the 
white team throughout the competition. 
Typical business tasks called injects may be 
to add new users, backup data, and add a 
network printer. Points will be awarded for 
keeping required services up and inject re¬ 
quests completed. Points will be deducted 
for required services being down and suc¬ 
cessful penetration by the red team. The 
team with the highest number of points wins 
the competition. 

The scoring model involves giving points for 
successful completion of injects, taking 
points away for failure to maintain required 
business services, and deducting points for 
successful red team exploits. 

Injects involve business requests such as 
account updates, blocking AIM and P2P, and 
Network Redesign. Most injects are scored 
by a White Team member observing the sys¬ 
tem change. A few injects may also re¬ 
quire a written report or presentation. The 
number of points given for injects vary, for 
example, configuring SSH access on a sys¬ 
tem may be worth a total of 50 points, 
creating/enabling new user accounts 100 
points, and installing new infrastructure 
hardware 100 points. 

The scoring engine tracks whether HTTP, 
HTTPS, SSH, POP and other required servic¬ 
es are up or down, with points given for ser¬ 
vices being up during measured intervals. 
When a Red team member succeeds with an 
exploit against one team, the same exploit 
must be attempted against all teams and 
scored accordingly. 

While we have not included Easter eggs and 
treasure hunts as part of the current compe¬ 
tition, these added activities are under con¬ 
sideration for future events. 


Regional competitions are permitted to de¬ 
fine additional color teams for infrastructure 
needs at the university hosting the competi¬ 
tion. The operations team ensures that all 
the needed hardware and software is availa¬ 
ble and ready for each blue team. For each 
red team, the necessary network resources 
are available and ready. And most impor¬ 
tantly that the all blue teams are connected 
to a central router and scoring system for 
the white team. While all this is going on, 
the operations team needs to ensure that 
the hosting university's network services are 
not impacted. 

National Competition 

Universities became excited with the expe¬ 
rience gained by students in competitions 
like these that regional competitions are now 
held and the regional's top team is sent to 
the National Collegiate Cyber Defense Com¬ 
petition at the University of Texas, San An¬ 
tonio. Today there are 6 regional competi¬ 
tions held in the Mid-Atlantic, Midwest, 
Northeast, Southeast, Southwest, Northwest 
and the Western. See Figure 1 below for 
years of 1 st Regional Competitions. 

Southeast Southeast Northeast 

2005 2006 2008 

• t • • • • 

Mid- M divest Western 

Allant c 2006 2008 

2006 

Figure 1: 1 st Regional Competitions Held in 
Each Region 

When a region covers more than one state 
with too many teams to accommodate, state 
competitions are held where the winner of 
each state competition competes to be the 
regional winner that proceeds to the national 
competition in Texas. 

The Western Region includes California, Ne¬ 
vada, and Arizona. The Southeast Region 
includes Kentucky, Tennessee, South Caroli¬ 
na, Mississippi, Alabama, Georgia, and Flori¬ 
da. The Southwest Region includes New 
Mexico, Texas, Oklahoma, and Arkansas. 
The Northwest Region includes Alaska, Ore¬ 
gon, Idaho, and Washington. The Mid- 
Atlantic Region includes Pennsylvania, Vir¬ 
ginia, West Virginia, Maryland, Delaware, 
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and New Jersey. The Northeast Region in¬ 
cludes New York, Connecticut, New Hamp¬ 
shire, Massachusetts, Maine, Vermont, and 
Rhode Island. The Midwest Region includes 
Minnesota, Iowa, Michigan, Wisconsin, Illi¬ 
nois, Indiana, and Ohio. The Central Region 
consists of Utah, Colorado, Nebraska, Mis¬ 
souri, Montana, North Dakota, South Dako¬ 
ta, and Wyoming. See Figure 2 below for 
regional groupings. 



Figure 2: Regional CCDC Map 


Since the first National Collegiate Cyber De¬ 
fense Competition, several published papers 
have emphasized the value and potential of 
these competitions. Conklin (2006) men¬ 
tions the "opportunity for active and colla¬ 
borative learning." White and Dodge (2007) 
highlight the increase in security awareness 
and interest in computer security at schools 
involved in the competition. Mattson 
(2007) highlights the impact of "hands-on, 
real-world training these events provide". 
Chu, et. al. (2007) adds that even with cur¬ 
rent success, more work is needed to "pro¬ 
mote student's creative design and problem 
solving skills." The Collegiate Cyber Defense 
Competitions "gives us the opportunity to 
put your brain power, your education, your 
experience and skills into this whole area of 
network security" (Cooley, 2008). 

4. EVENT PLANNING 

A Computer Information Systems (CIS) fa¬ 
culty from Cal Poly Pomona attended the 
2006 CCDC Midwest Regional scoring work¬ 
shop at Moraine Valley Community College 
and the 2007 CCDC Midwest Regional, also 
at Moraine Valley. Attending provided valu¬ 
able experience and understanding of critical 
success factors to run a cyber defense com¬ 
petition. At the June 2007 Colloquium for 
Information Systems Security Educators, Dr. 
Greg White from the University of Texas, 


San Antonio presented findings on the re¬ 
cent 2006 National CCDC. After the presen¬ 
tation, Cal Poly Pomona committed to host 
the 2008 Western Regional CCDC. 

In the spring of 2007, a Computer Informa¬ 
tion Systems Senior Project team assisted in 
early preparation for Cal Poly Pomona to 
host the 2008 Western Regional Collegiate 
Cyber Defense Competition (CCDC). The 
project involved students working with the 
computers and associated network equip¬ 
ment to test the equipment functionality 
needed to support the competition. In the 
summer of 2007, two additional Senior 
Project teams continued preparation efforts 
for the Western Regional CCDC. Both 
teams developed a Western Regional CCDC 
website, marketing materials, and prepared 
equipment for a mock competition. The 
website was critical to promoting the compe¬ 
tition to students, white and red team mem¬ 
bers, sponsors and the media. The website 
included sections on registration, sponsor¬ 
ship, location, and a FAQ. 

After the mock competition, it was clear that 
significant work was needed to prepare an 
adequate competition infrastructure. In 
the fall of 2008, James Schneider, a CIS 
student and Network Analyst at Cal Poly 
Pomona continued infrastructure research 
and development for the Western Regional 
CCDC. One result of this research was the 
following network diagrams for the competi¬ 
tion. Figure 3 illustrates the network design 
for the blue teams while Figure 4 shows the 
topology for the entire competition. 

Each student team is provided the following: 

. CISCO 1841 Router 

• CISCO ASA Security Appliance for 
firewall, Unified Communications 
(voice/video) security, SSL and IP- 
sec VPN, intrusion prevention (IPS), 
and content security services 

• CISCO switch 

• 4 servers with Windows 2003, Win¬ 
dows 2000, Gentoo Linux, and 
Ubuntu Linux operating systems 

• 2 local machines with Windows XP 
operating system 
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Blue Team General Diagram 

Note: X = Team Subnet ID 


Cisco 2950 



Cisco 1841 ASA 5510 

FaO/0-IOO.O.X® EhM- 192.168X2/30 (OUTSIDE) 
Fa 0/1 - 192163.X. 1/30 ElhO/1 - 192.168X6526 (INSIDE) 



Windows 2003 


192.168X114)26 
Primary Domain CorrtrcOar 

POP 




Figure 3: Blue Team Diagram 


Blue Team 


Blue Team 


Competition 

Backbone 


The Internet 


Operations- y 
Team 


Red Team 


Figure 4: Competition Topology 

Because Cal Poly Pomona had never held a 
contest requiring a dedicated network infra¬ 
structure and multiple computer networks, 
testing became a priority. In addition, stu¬ 
dents were encouraged to become part of 
the testing process to create interest in the 
competition. Weekend testing in a computer 
lab/classroom first occurred the weekend of 
12/7 and 12/8/2007. Testing continued on 
12/23, 1/26 and 1/27, 2/9 and 2/10, 2/16 
and 2/17, 2/23 and 2/24, and weekend of 
3/8 and 3/9. A final test was held with Red 
Team members on 3/15. 


In January 2008 the following call for com¬ 
petitors was e-mailed to 2 and 4 year 
schools in Southern California. "I would like 
to invite you and your students take part in 
a new event we are hosting this Spring. We 
are hosting the first Western Regional Colle¬ 
giate Cyber Defense Competition (CCDC) on 
March 28th, 29th and 30th. We are very 
interested in a student team from your 


school. The CCDC is the first competition 
that specifically focuses on the operational 
aspect of managing and protecting an exist¬ 
ing "commercial" network infrastructure." 
(Western Collegiate Cyber Defense Competi¬ 
tion website). 

While most student and faculty feedback 
was positive for competing in a cyber de¬ 
fense competition, there were strict limits on 
who could compete as stated in the following 
rule from the National CCDC. "Each team 
member must be a full-time student of the 
institution the team is representing and 
must not be currently employed in the IT 
industry (security operations, network ad¬ 
ministrator, system administrator, pro¬ 
grammer, network operations, help desk, 
etc.) as a salaried employee or as an hourly 
employee for more than 20 hours per week. 
Team members must qualify as full-time 
students as defined by the institution they 
are attending - typically this means the team 
member must be enrolled in 12 or more 
semester credit hours for undergraduates 
and 9 or more semester credit hours for 
graduate students during the semester the 
competition is held." (National Collegiate 
Cyber Defense Competition website). 

Because we could not allow less than full¬ 
time students and students working more 
than half-time in IT, we struggled to receive 
commitments from students for the competi¬ 
tion. What finally enabled us to have four 
teams competing was our sponsor support. 
A month before the competition, we were 
able to make the following statement to stu¬ 
dent teams. ''Because of our sponsors, we 
should be able to provide entry fee, meals, 
and two nights lodging (double occupancy) 
for teams competing in the CCDC." 

Sponsors 

Obtaining sponsors was just as critical as 
student teams for the competition. One 
successful way to obtain sponsors does not 
exist, but many avenues do exist. Cal 
Poly Pomona faculty had existing relation¬ 
ships with several audit and security related 
professional associations. Face-to-face 
presentations and meetings with local chap¬ 
ters of the Institute of Electrical and Elec¬ 
tronics Engineers (IEEE), Information Sys¬ 
tems Security Association (ISSA), Informa¬ 
tion Systems Audit and Control Association 
(ISACA), and High Technology Crime Inves- 
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tigation Association (HTCIA) all resulted in 
monetary sponsorships for the Western Re¬ 
gional CCDC. 

Additional sponsorships were found through 
two other types of contacts. Ernst and 
Young and Aerospace Corporation both re¬ 
cruit CIS graduates, and committed to spon¬ 
soring the competition. Microsoft and McA¬ 
fee have strong vendor relationships with 
our schools, and became sponsors. McA¬ 
fee's strong relationship with the California 
State University System help secure them as 
a title sponsor for the competition. 

Red and White Team Formation 

Simultaneous with obtaining sponsorships 
was the creation of a Red Team of profes¬ 
sional security experts and a White Team of 
competition referees. Our first Red Team 
member, Rodney Kocot, and our first White 
Team member, Michael Felker, were re¬ 
cruited at an ISACA Meeting. Attending the 
1/29/2008 Quarterly meeting of the Los An¬ 
geles Electronic Crimes Task Force was a 
turning point in creating a Red Team. At the 
meeting Jimmy Garcia, Supervising Investi¬ 
gator of the High Technology Crimes Inves¬ 
tigation for the Los Angeles District Attor¬ 
ney's Office committed to being part of the 
Red Team for the competition. Jimmy was 
a major reason for the success of the com¬ 
petition, as he brought Donn Hoffman, Dave 
Maupin and Justin Pheffer from his office as 
Red Team Members, and made possible Mr. 
Steve Cooley, Los Angeles County District 
Attorney, to be our opening keynote speak¬ 
er. 

In addition to testing, numerous conference 
calls were held. The conference calls enabled 
formation of the Red and White Teams, dis¬ 
cussion and agreement of competition rules, 
schedule and logistics. We were also able 
to share documentation from prior National 
and Regional Collegiate Cyber Defense Com¬ 
petitions, including injects (service requests) 
that were to be assigned to the student 
teams during the competition. As the com¬ 
petition drew near, the White team held 
separate conference call to finalize injects. 

The actual competition had a few glitches, 
none of which kept the competition from 
being viewed as a success. After the key¬ 
note speaker, Blue Teams were supposed to 
have two hours to secure their systems be¬ 
fore Red Team attacks began. Due to net¬ 


work issues, the Red Team attacks were de¬ 
layed by 90 minutes. White team injects 
were adjusted throughout the competition. 

5. COMPETITION OUTCOMES 

A survey of participants after the competi¬ 
tion confirmed its value. Typical comments 
included: 

• "Not bad, but better if there were 
more faculty present" 

• "Given the constraints, I thought it 
went very well" 

• "Love this stuff, but as you noticed it 
is difficult to mockup" 

• "I would do this again" 

As a participant university of the 2008 West¬ 
ern Regional Cyber Defense Competition, 
several benefits deserve mentioning in the 
areas of knowledge integration, applying 
classroom learning to the real world, team¬ 
work, faculty participation, equipment, uni¬ 
versity administration support, student lea¬ 
dership, training, and preparation. Each 
area is discussed in more detail below. 

Knowledge integration is the key to success¬ 
ful college learning. One of the major prob¬ 
lems of an MIS program is that pieces of 
knowledge/skill sets are learned through 
different classes and one capstone course 
usually helps students to put everything to¬ 
gether; but not nearly enough to have the 
depth students need to be a successful IT 
professional. This competition allowed stu¬ 
dents to demonstrate their understanding of 
network security at a detailed level. 

While putting everything together is impor¬ 
tant, bridging the gap of classroom learning 
and real world IT is another hurdle in stu¬ 
dent learning. An instructor could easily 
explain to students we are doing real IT 
(networking in this case); but it would very 
difficult to explain well to them the only dif¬ 
ference is that we are somewhat structured 
in class while the real IT is less structured 
where more random variables need to be 
considered. With this competition, it made 
it easier to tell the difference. 

Teamwork is a somewhat paradoxical word 
in college classrooms. We all do it in our 
projects and assignments; yet most students 
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hate it. They suffer when they are stuck 
with an underperforming team in the class¬ 
room. The competition made them work as 
a team without thinking of it. As a matter 
of fact, one cannot do all that is required in 
this competition. They learned to leverage 
each others' strength and learn together. 

While participating in the cyber defense 
competition, a few lessons were learned in 
several areas: 

• Training for faculty - faculty may not 
have managed a real network, nor 
defended a problematic one. If 
trained in setting up and securing a 
network, faculty would be able to 
form a balanced student team with 
critical skill sets to compete well. In 
addition, faculty could hold their own 
mock competitions and would not be 
dependent on traveling to regional 
mock competitions to practice. 

• Equipment - With the state budget 
shrinking, most schools cannot af¬ 
ford state-of-the-art network equip¬ 
ment for classes to experiment. In¬ 
stead, a very minimal number of old 
networking devices are used. 

• A competition of this scale needs the 
involvement from more than one fa¬ 
culty member for each team. With 
multiple Operating System environ¬ 
ments, selection of tools, vendor 
specific requirements, hacking de¬ 
fense and business analysis skills, it 
is unrealistic that one faculty mem¬ 
ber can master everything needed to 
ensure your team's success in the 
competition. Even though faculty 
are not directly involved in the com¬ 
petition itself, departmental or even 
a college's expertise should be leve¬ 
raged during training. 

• Administration support - Deans and 
chairs may not know what you are 
doing unless you win something, but 
not everyone is a winner. We feel 
every team needs the financial and 
resource support from their adminis¬ 
tration. 

• Release time for faculty - This is the 
only way to have a sustainable pro¬ 
gram like the regional collegiate cy¬ 
ber defense competition. Release 


time would enable the faculty advi¬ 
sors) to spend ample time and 
energy to prepare their team for the 
competition. 

• Student leader - Without one, it is 
not going to happen; the faculty 
member's role is to identify, encour¬ 
age and support students to partici¬ 
pate in competitions such as these. 

Students provided suggestions to improve 
future competitions: 

• Add a Traffic Generator so that Red 
Team activity is masked with normal 
consumer activity on the website. 

• Require website access for White 
Team to also act as a consumer. 

• Blue Teams should not be allowed to 
block everyone except the scoring 
engine. 

• Red Team members should be al¬ 
lowed to perform social engineering 
as this is a common ploy used by 
would-be hackers. 

• Allow anyone access to the room 
which forces teams to be diligent of 
the physical perimeter. 

For the team when preparing for the compe¬ 
tition: 

• Plan to train early, usually six 
months before the competition. 

• Train by reserving a student lab for a 
couple hours, two to three days a 
week. 

• Provide training for the team in Cis¬ 

co, networking, Linux, computer fo¬ 
rensics, Active Directory, 

Email/Exchange, LDAP, Unix and 
Cisco ASA Firewalls to ensure that 
the team is well rounded to compete 
successfully. 

• Flacking Tools - teams should create 
their own toolbox to aid in the detec¬ 
tion of suspicious activity (i.e., web¬ 
sites to use, tools you want to down¬ 
load, etc.). 

When the blue team is competing: 

• Install the Service packs first. 
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• Get the services up and running 
(DNS, Active Directory, Email both 
Exchange or open source, etc.). 

• Install critical updates. 

• Windows 2000 Server machine 
should be backed up and then de¬ 
leted. Keep the business data and 
load it into Windows 2003 Server 
machines. 

6. CONCLUSION 

Regional Collegiate Cyber Defense Competi¬ 
tions were developed to protect what the 
government, organizations, and individual's 
value. Regional Collegiate Cyber Defense 
Competitions do prepare students to defend 
a network while under attack. As evidenced 
by the end-of-competition feedback, mem¬ 
bers of all teams felt that the competition 
was well worth the time and energy ex¬ 
pended. Suggestions from all teams on 
ways to improve the future competitions are 
instrumental in planning the next competi¬ 
tion. 

Universities that want to provide real-world 
experience to their students should categori¬ 
cally consider conducting mock competitions 
on their campus and competing at a Region¬ 
al Collegiate Cyber Defense Competition. 
The competition provides experience that 
can't be taught in the classroom and pro¬ 
vides skills that are marketable upon gradu¬ 
ation. 

The Los Angeles County District Attorney 
Steve Cooley summed it all up by saying, 
"The Collegiate Cyber Defense Competitions 
gives us the opportunity to put your brain 
power, your education, your experience and 
skills into this whole area of network securi¬ 
ty. Develop an attitude, have the ethics, 
develop the techniques, learn from one 
another so you can be defenders of our 
great system". 
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